A vulnerability in the handling of IP sockets can cause devices to be
vulnerable to a denial of service attack when any of several features of Cisco
IOS? Software are enabled. A sequence of specially
crafted TCP/IP packets could cause any of the following results:

The configured feature may stop accepting new connections or
sessions.

The memory of the device may be consumed.

The device may experience prolonged high CPU utilization.

The device may reload.

Cisco has released free software updates that address this
vulnerability.

Several mitigation strategies are outlined in the "Workarounds" section
of this advisory.

Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication
includes eight Security Advisories. All of the advisories address
vulnerabilities in Cisco IOS Software. Each advisory lists the releases that
correct the vulnerability or vulnerabilities in the advisory.

Devices that are running affected versions of Cisco IOS Software and
Cisco IOS XE Software are affected if they are running any of the following
features. Details about confirming whether the affected feature is enabled on a
device are in the "Details" section of this advisory.

To determine the Cisco IOS Software release that is running on a Cisco
product, administrators can log in to the device and issue the
"show version" command to display the system banner.
The system banner confirms that the device is running Cisco IOS Software by
displaying text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses, followed by
"Version" and the Cisco IOS Software release name. Other Cisco devices do not
have the "show version" command or may provide
different output.

The following example identifies a Cisco product that is running Cisco
IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:

If the telephony-service security parameters have been configured with
"device-security-mode", the device is vulnerable. The
following example shows three vulnerable configurations for telephony-service
security parameters:

The global telephony-service or call-manager-fallback command
has been configured.

Any Cisco IOS configuration with the global
"telephony-service" or
"call-manager-fallback" command is vulnerable if any
subcommands are in the telephony-service or call-manager-fallback configuration
mode. The following examples show vulnerable configurations:

telephony-service
ip source-address 192.168.0.1 port 2011

or

call-manager-fallback
ip source-address 192.168.0.1 port 2011

The TCP port used is defined with the "ip source-address
<address> port <port-number>" configuration
command.

Secure Signaling and Media Encryption

A device is vulnerable if it is configured with the Media and Signaling
Encryption (SRTP/TLS) on DSP Farm Conferencing feature or with Secure Signaling
and Media Encryption for analog phones with Skinny Call Control Protocol
(SCCP).

The following examples show three different vulnerable secure DSP farm
configurations. Several other parts are required for a full configuration, such
as certificates and SCCP configuration, but these parts have been excluded for
brevity.

The following output shows the relevant section of Secure Signaling and
Media Encryption for analog phones and is a vulnerable configuration (Several
other parts are required for a full configuration, such as certificates, SCCP
configuration, and dial peers):

Blocks Extensible Exchange Protocol

Any configuration or executable command that leverages Blocks
Extensible Exchange Protocol (BEEP) as a transport protocol is vulnerable. The
following example shows the vulnerable configuration of the feature NETCONF
over BEEP. NETCONF over BEEP using SASL is also vulnerable.

Devices that have URL redirect feature configured are vulnerable. URL
redirect is supported for EAP over UDP (EAPoUDP), Dot1x and MAC Authentication
Bypass (MAB) authentication mechanisms. The URL redirect configuration can
either be on the server or set up as part of a locally defined profile or
policy. Both configurations are vulnerable. A device is vulnerable with either
of the following configurations.

URL Redirect Feature Enabled for EAPoUDP

The URL redirect feature is enabled for EAPoUDP with the following
global configuration command:

ip admission name <EAPoUDP-rule-name> eapoudp

The following configuration attaches the EAPoUDP rule (created in the
previous example) to an interface.

ip admission name <EAPoUDP-rule-name>

URL Redirect Feature Enabled for Dot1x and MAB

The URL redirect feature for both Dot1x and MAB are vulnerable and will
have a URL redirect AV pair on the RADIUS server defined in a method that is
similar to the following:

url-redirect="http://example.com"
url-redirect="urlacl"

For the Dot1x and MAB URL redirect feature to work successfully on the
switch, the minimum following configuration would also be required. There is no
interface-specific configuration for URL redirect. Basically the interface has
to be configured for Dot1x/MAB.

ip http {server | secure-server}
ip device tracking

The default TCP port used for per-user URL redirect for EAPoUDP, Dot1x,
and MAB is 80 and 443.

DNS

Devices that are configured with the Cisco IOS DNS feature are
vulnerable. A pure DNS over UDP implementation is not vulnerable. See the
"Workarounds" section of this advisory for information about filtering DNS over
TCP traffic to the device. If any of the commands in the
following example appear in the device configuration, the device is
vulnerable:

Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in
this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of the
vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS
at

When considering software upgrades, also consult
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete upgrade
solution.

In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current hardware and
software configurations will continue to be supported properly by the new
release. If the information is not clear, contact the Cisco Technical
Assistance Center (TAC) or your contracted maintenance provider for assistance.

Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the earliest
possible releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed Release"
column of the table. The "Recommended Release" column indicates the releases
which have fixes for all the published vulnerabilities at the time of this
Advisory. A device running a release in the given train that is earlier than
the release in a specific column (less than the First Fixed Release) is known
to be vulnerable. Cisco recommends upgrading to a release equal to or later
than the release in the "Recommended Releases" column of the table.

The following mitigations have been identified for this
vulnerability:

Infrastructure Access Control Lists

Although it is often difficult to block traffic that transits a
network, it is possible to identify traffic that should never be allowed to
target infrastructure devices and block that traffic at the border of networks.
Infrastructure Access Control Lists (iACLs) are a network security best
practice and should be considered as a long-term addition to good network
security as well as a workaround for these specific vulnerabilities. The iACL
example below should be included as part of the deployed infrastructure
access-list which will protect all devices with IP addresses in the
infrastructure IP address range:

Receive ACLs (rACL)

For distributed platforms, Receive ACLs may be an option starting in
Cisco IOS Software Versions 12.0(21)S2 for the 12000 (GSR), 12.0(24)S for the
7500, and 12.0(31)S for the 10720. The Receive ACL protects the device from
harmful traffic before the traffic can impact the route processor. Receive ACLs
are designed to only protect the device on which it is configured. On the
12000, 7500, and 10720, transit traffic is never affected by a receive ACL.
Because of this, the destination IP address "any" used in the example ACL
entries below only refer to the router's own physical or virtual IP addresses.
Receive ACLs are considered a network security best practice, and should be
considered as a long-term addition to good network security, as well as a
workaround for this specific vulnerability. The white paper entitled "GSR:
Receive Access Control Lists" will help you identify and allow legitimate
traffic to your device and deny all unwanted packets. This white paper is
available at the following link
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a0a5e.shtml.

The following is the receive path ACL written to permit this type of
traffic from trusted hosts:

Control Plane Policing

Control Plane Policing (CoPP) can be used to block the affected
features TCP traffic access to the device. Cisco IOS software releases 12.0S,
12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be
configured on a device to protect the management and control planes and
minimize the risk and effectiveness of direct infrastructure attacks by
explicitly permitting only authorized traffic that is sent to infrastructure
devices in accordance with existing security policies and configurations. The
CoPP example below should be included as part of the deployed CoPP which will
protect all devices with IP addresses in the infrastructure IP address range.

In the above CoPP example, the access control list entries (ACEs) that
match the potential exploit packets with the "permit" action result in these
packets being discarded by the policy-map "drop" function, while packets that
match the "deny" action (not shown) are not affected by the policy-map drop
function. Please note that the policy-map syntax is different in the 12.2S and
12.0S Cisco IOS trains:

Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.

Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.

Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party vendors but
are unsuccessful in obtaining fixed software through their point of sale should
acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC
contacts are as follows.

+1 800 553 2447 (toll free from within North America)

+1 408 526 7209 (toll call from anywhere in the world)

e-mail: tac@cisco.com

Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to a free
upgrade. Free upgrades for non-contract customers must be requested through the
TAC.

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

In addition to worldwide web posting, a text version of
this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.

cust-security-announce@cisco.com

first-teams@first.org

bugtraq@securityfocus.com

vulnwatch@vulnwatch.org

cisco@spot.colorado.edu

cisco-nsp@puck.nether.net

full-disclosure@lists.grok.org.uk

comp.dcom.sys.cisco@newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.